Exit demo PSE-CORTEX Palo Alto Networks System Engineer Professional - Cortex PDF format · free preview

Palo Alto Networks PSE-CORTEX - Questions & Answers

Free preview · every answer includes a full explanation

Product page: https://prepkeys.com/pse-cortex.html

Question 1
Multiple choice

A General Purpose Dynamic Section can be added to which two layouts for incident types? (Choose two)

A.

"Close" Incident Form

B.

Incident Summary

C.

Incident Quick View

D.

"New"/Edit" Incident Form

Question 2
Multiple choice

Which two entities can be created as a BIOC? (Choose two.)

A.

file

B.

registry

C.

event log

D.

alert log

Question 3
Single choice

If you have a playbook task that errors out.
where could you see the output of the task?

A.

/var/log/messages

B.

War Room of the incident

C.

Demisto Audit log

D.

Playbook Editor

Question 4
Single choice

Which option describes a Load-Balancing Engine Group?

A.

A group of engines that use an algorithm to efficiently share the workload for integrations

B.

A group of engines that ensure High Availability of Demisto backend databases.

C.

A group of engines that use an algorithm to efficiently share the workload for automation scripts

D.

A group of D2 agents that share processing power across multiple endpoints

Question 5
Multiple choice

During the TMS instance activation, a tenant (Customer) provides the following information for the fields in the Activation - Step 2 of 2 window.

During the service instance provisioning which three DNS host names are created? (Choose three.)

A.

cc-xnet50.traps.paloaltonetworks.com

B.

hc-xnet50.traps.paloaltonetworks.com

C.

cc-xnet.traps.paloaltonetworks.com

D.

cc.xnet50traps.paloaltonetworks.com

E.

xnettraps.paloaltonetworks.com

F.

ch-xnet.traps.paloaltonetworks.com

Question 6
Single choice

In an Air-Gapped environment where the Docker package was manually installed after the Cortex XSOAR installation which action allows Cortex XSOAR to access Docker?

A.

create a "docker" group and add the "Cortex XSOAR" or "demisto" user to this group

B.

create a "Cortex XSOAR' or "demisto" group and add the "docker" user to this group

C.

disable the Cortex XSOAR service

D.

enable the docker service

Question 7
Single choice

An administrator of a Cortex XDR protected production environment would like to test its ability to protect users from a known flash player exploit.

What is the safest way to do it?

A.

The administrator should attach a copy of the weapomzed flash file to an email, send the email to a selected group of employees, and monitor the Events tab on the Cortex XDR console

B.

The administrator should use the Cortex XDR tray icon to confirm his corporate laptop is fully protected then open the weaponized flash file on his machine, and monitor the Events tab on the Cortex XDR console.

C.

The administrator should create a non-production Cortex XDR test environment that accurately represents the production environment, introduce the weaponized flash file, and monitor the Events tab on the Cortex XDR console.

D.

The administrator should place a copy of the weaponized flash file on several USB drives, scatter them around the office and monitor the Events tab on the Cortex XDR console

Question 8
Single choice

"Bob" is a Demisto user.

Which command is used to add 'Bob" to an investigation from the War Room CLI?

A.

#Bob

B.

/invite Bob

C.

@Bob

D.

!invite Bob

Question 9
Single choice

An antivirus refresh project was initiated by the IT operations executive.
Who is the best source for discussion about the project's operational considerations'?

A.

endpoint manager

B.

SOC manager

C.

SOC analyst

D.

desktop engineer

Question 10
Single choice

When analyzing logs for indicators, which are used for only BIOC identification'?

A.

observed activity

B.

artifacts

C.

techniques

D.

error messages

Showing 10 of 60 questions · Unlock the full set